Quantum privacy and quantum coherence 



Benjamin Schumacher 

Department of Physics, Kenyan College, Gambier, OH 43022 USA 



Michael D. Westmoreland 
Department of Mathematical Sciences, Denison University, Granville, OH 43023 USA 



Abstract 

We derive a simple relation between a quantum channel's capacity to convey 
coherent (quantum) information and its usefulness for quantum cryptography. 
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A quantum communication channel can be used to perform a variety of tasks, including: 



• Conveying classical information from a sender to a receiver. 

• Conveying quantum information (including quantum entanglement) from a sender to 
a receiver. 

• Creating shared information between a sender and receiver, information that is reliably 
secret from any third party and can thus be used as a cryptographic key for later private 
communication. (The use of quantum channels to aid in cryptographic tasks such as 
key distribution is called quantum cryptography.) 

Each of these tasks can be performed in the presence of noise. Indeed, in quantum cryptog- 
raphy the noise is of central importance in revealing the activity of an eavesdropper. 

Deutsch et al. |jl|] examined the security of quantum cryptographic schemes over quantum 
channels that contain noise. They pointed out that any protocol which allowed "entangle- 
ment purification" between two parties automatically provided a means of communicating 
secret information that no third party could share. Here we will continue this line of thought 
by showing that the privacy of the channel, measured by the amount of information available 
to the receiver that is not available to any eavesdropper, can be made at least as great as 
the channel's coherent information 0. 

Suppose Alice prepares a quantum system Q in an initial state p^. Alice conveys the 
system Q through a noisy quantum channel to Bob. The noisy channel may be described 
by a superoperator so that the final state p'^' = £^{p^). 

The evolution of the channel given by the superoperator 8^ is in fact unitary evolution on 
a larger quantum system that includes the environment E of the system. This environment 
may be considered to be initially in a pure state 0^^. In this case, the superoperator is 
given by 

tQE^ 



SQ{pQ) = Tr^f/^^ (p« ® |0^)(0^|) /7«^\ (1) 



We can assume that the environment is initially in a pure state without any loss of generality, 
since we can always imagine that a "local" environment in a mixed state is just part of a 
larger system in a pure entangled state. 

We imagine first that the initial mixed state p^ of Q arises from Q's entanglement with 
some other "reference" system R in Alice's possession. Alice's goal in sending Q to Bob is 
to establish some quantum entanglement between her reference system R and Bob's output 
system Q'. That is, Alice is sending quantum information via the channel to Bob. 

As discussed in 0], the entropy exchange Se measures the amount of information that 
is exchanged between the system Q and the environment E during their interaction. If 
the environment is initially in a pure state, the entropy exchange is just the environment's 
entropy after the interaction — i.e., Se = S{p^ ), where p^ is the final state of E. (The 
entropy here is just the ordinary von Neumann entropy of a density operator, S{p) = 
— Trplog p.) The entropy exchange is entirely determined by the initial state p*^ of Q and the 
channel dynamics superoperator that is, the entropy exchange is a property "intrinsic" 
to Q and its dynamics. 

The coherent information Je, introduced in ||^, is given by 
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(2) 



The coherent information has many properties that suggest it as the proper measure of the 
quantum information conveyed from Ahce to Bob by the channel. For example, le can never 
be increased by quantum data processing performed by Bob on the channel output, and 
perfect quantum error correction of the channel output is possible for Bob if and only if no 
coherent information is lost in the channel . The coherent information seems to be related 
to the capacity of a quantum channel to convey quantum states with high fidehty 0]. 

Alice might on the other hand be using the channel to send classical information to Bob. 
Alice prepares Q in one of a set of possible "signal states" , which are used by Alice with 
a priori probabilities pk- The average state p^ is given by 

p'' = Ep>^pI (3) 

k 

Bob receives the kth. signal as = £^{p2)- Because the superoperator is hnear, the average 
received state is 

P«' = EP'^^''(p^)=^''(p^)- (4) 

k 

Bob attempts to decode Alice's message (that is, to identify which signal state was chosen 
by Alice) by measuring some decoding observable on his received system Q' . 

The amount of classical information conveyed from Alice to Bob, which we will denote 
if Bob, is governed by the quantity ; defined by 

X«' = 5(p«')-EP^^(pf)- (5) 

k 

This quantity is significant in two ways: 

• Hsoh < X*^') regardless of the decoding observable chosen [1,0. 

• Hsob can be made as close as desired to to x^' by a suitable choice of code and decoding 
observable. To make HBob near x^ ■, Alice must in general use the channel many times 
and employ code words composed of many signals; Bob must perform his decoding 
measurement on entire code words. The net result is that the channel is used times 
to send up to Nx'^ bits of classical information reliably 0. 

In short, x*^' represents an upper bound on the classical information conveyed from Alice to 
Bob, an upper bound that may be approached arbitrarily closely if Alice and Bob use the 
channel efficiently. 

If this general picture is used to describe a quantum cryptographic channel, then the 
eavesdropper ("Eve") must be supposed to have access to some or all of the environment 
system E with which Q interacts. In other words, the environment includes any apparatus 
used by Eve to gather information about Alice and Bob's communication. The evolution 
superoperator £^ thus describes all of the effects of the eavesdropper on the channel; or, to 
put it another way, all of the eavesdropper's efforts at "tapping" the link between Alice and 
Bob are contained in the interaction operator U'^^ . The information Hevc available to the 
eavesdropper will be limited by 
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X 



Sip""') -Y.p^s{pf) 



(6) 



The limitation Hevc < X^' holds whether or not Eve has access to the entire environment. 
If Eve can only see a subsystem D of the full environment, then we can make the stronger 
statement Heve < X^ i where ^ X^ Hi- 
We define the "privacy" P of a channel to be 



P = H 



Bob 



H 



Eve- 



(7) 



This definition makes sense, because any positive difference HBob — Hevc can be exploited 
by Alice and Bob to create a reliably secret string of key bits of length about P f^. 

Alice and Bob wish to make P as large as possible. However, they cannot control the 
actions of the eavesdropper. Thus, they must assume that the eavesdropper is acquiring 
her greatest possible information from the channel. The "guaranteed privacy" Pq = inf P, 
where the infimum is taken over all of Eve's possible strategies that are consistent with the 
superoperator describing the channel. Since Hevb < X^' i we have 

Pg > Hsoh 



X 



E' 



(8) 



Alice and Bob will want to use the channel to make the guaranteed privacy Pg as great 
as possible. Let V = sup Pg be the optimal guaranteed privacy, where the supremum is 
taken over all strategies that Alice and Bob may employ to use the channel. How big is P? 
As discussed above, by suitable choice of code and decoding observable, Hsob can be made 
arbitrarily close to x'^ ■ Thus, 



(9) 



If Alice and Bob were simply trying to optimize HBob over a given noisy channel, it is 
known that they can do no better than to choose pure states of Q as the inputs signal 
states of the channel. Here, they are instead trying to maximize the guaranteed privacy Pg, 
so that pure state inputs may not be optimal. However, we can certainly find a lower bound 
for P by considering x^ ~ X^ for pure state inputs. 



Assume that the states of Q initially prepared by Alice are pure states 



that the environment E can be presumed to begin in a pure state 



E interact unitarily, the joint state 



QE' 



0' 



; also recall 
After Q and 



JjQE 



generally an entangled one. The subsystem states, described by density operators 



Pk 
Pk' 



Tr^j 
Tro 



QE' 



QE' 



QE' 
k 

QE' 



0-^) will also be a pure state, 



(10) 



will have exactly the same non-zero eigenvalues, so that S{p2 ) = S{pf). Therefore 

IQ = S(pQ') - 

= S{p^') - S{p^') 

= sip"^') - Ep^^(pf ) - Sip""') + T.p^s{pf') 



jQ 



X 



Q' 



X 



(11) 
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We conclude that 



V > I^. (12) 

In other words, the abihty of the quantum channel to send private information is at least as 
great as its ability to send coherent information. This result may be viewed as a quantum 
information theoretic basis for quantum cryptography. 

It is interesting to note that, although both x'^ and depend on the choice of pure 
state inputs for the channel Q, the difference x^' ~ X^' depends only on the overall density 
operator p'^ for the inputs. 

We have assumed that the properties of the channel, given by the superoperator are 
known to Alice and Bob. If 8^ is known, and if J*^ > for some p*^, then the channel may 
be used to send private information securely. However, this does not address the question 
of how Alice and Bob can establish the necessary properties of the channel without being 
deceived by Eve. 

We would like to thank W. K. Wootters and M. A. Nielsen for helpful conversations and 
suggestions. 
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